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PROFESSIONALISM: COMING OR NOT? 


Professionalism in the computer field has been debated for 
years. Are systems analysts and programmers “professionals” or 
aren't they? We gather that a good many people adopt the atti- 
tude, ““Who cares?” However, we feel the subject is important to 
data processing management. Somewhat like privacy legislation, 
some aspects of professionalism are on the way (although not as 
rapidly as privacy). Further, they may have an effect on which ap- 
plication systems you may build and/or how you must build 
them. We have expanded the subject to include system certifica- 
tion and the unionization of analysts and programmers, since 
all tend to impose types of regulation on computer-using 


organizations. 


O.. last previous issue on the subject of profes- 
sionalism in the computer field was in December 
1968. It is interesting to consider what has and 
what has not happened in the intervening seven 
years, as it gives some idea of how rapidly the 
concepts are being accepted. 

One’s first impression might be that “nothing 
significant has happened since 1968, as far as com- 
puter field professionalism is concerned.” We 
don’t agree. Here are the high points of what has 
happened, as we see it. 

United States. The Institute for Certification 
of Computer Professionals (1ccr) has been 
formed, with eight computer field societies as 
charter members—including DPMA, ACM, IEEE CS, 
and the Canadian Information Processing So- 
ciety. It has taken over the ppMa cpp and RBP ex- 


aminations, and will be upgrading them as well as — 


adding new examinations. We will discuss this 
later in this report. An important aF1ps study, on 
the definition of the job of programmer, has been 
completed and another is underway on defining 
the system analyst’s job. Bills proposing the li- 
censing of data processing personnel have been 


introduced in state legislatures, but they have en- 
countered little support, as far as we can tell. The 
Privacy Act of 1974 is in force and may well lead 
to the certification of systems, as far as some secu- 
rity and privacy features are concerned. 

Canada. As mentioned, cips is a member of 
iccp, indicating interest in the certification of 
analysts and programmers. In addition, the Infor- 
matics Institute of Canada (11c) has been formed; 
one of its goals is to develop more professional 
standards for people working in both the public 
and the private sectors. 

United Kingdom. The British Computer So- 
ciety examination was just barely underway the 
last time we wrote on this subject. It is now an on- 
going part of Bcs activities and other computer 
societies are considering adopting it. Bcs has a 
code of conduct (ethics), along with an enforce- 
ment mechanism. It also has developed a code of 
good practice, which aims to provide voluntary 
standard practices for the design and operation of 
computer-based data systems. : 

Scandinavia. Denmark, Finland, and Sweden 
have worked on developing standard job titles, for 
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computer-related jobs, and on developing some 
standard job definitions. 

Netherlands. As we discussed last month, The 
Netherlands has an extensive government- 
supported certificate program, including a series 
of examinations, for analysts and programmers. It 
is in active use, and is used by employers for hir- 
ing, promotions, raises, and so on. 

So things are happening in the area of 
professionalism. 


Why the subject is important 


Surely if anything of any substance material- 
izes in the certification of people, system certifi- 
cation, or the unionization of analysts and 
programmers, it will be important to data proc- 
essing management. It can affect the selection of 
which new systems to build, how they must be 
built, and which people can work on them. The 
effects may vary from state to state (within the 
U.S.) and from country to country. Profes- 
sionalism might motivate staff members to im- 
prove their capabilities, it could bring about more 
commonality of approaches, it could be used for 
hiring, promotions and raises, and it could help 
determine “who is qualified.” On the negative 
side, professionalism might well increase staff mo- 
bility and hence turnover, and it probably would 
lead to higher salaries for the ’’professionals.”’ 

But what leads one to believe that any aspect of 
professionalism will come to the computer field? 
As we indicated above, the subject is under study 
in many countries of the world, and there is no 
evidence that interest is dying away. Profes- 
sionalism is in harmony with the times (whether 
one agrees with it or not). That is, there is a con- 
stant increase in the amount of regulation of our 
personal and business lives, as well as an increase 
in social consciousness. So the times may encour- 
age the development of professionalism and the 
regulation it implies. Professionalism may come 
as a side effect of other legislation; we have men- 
tioned that privacy legislation may lead to a form 
of system certification. And it is possible that the 
general public may become sufficiently annoyed 
with or fearful of computer-based systems that 
some sort of regulating legislation will be 
enacted. 

Many of the aspects of professionalism that we 
are discussing can impact a company’s data proc- 
essing function. Further, it is possible (although 
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unlikely) that all of these aspects will come into 
effect in the next five to ten years. So it is a subject 
that we believe data processing management 
should stay abreast of. 


Professionalism activities 


What is a profession? What is a professional? 
These are not easily answered questions. In our 
December 1968 report, we gave some of the 
“generally accepted” characteristics of a profes- 
sion: defined body of knowledge of high intellec- 
tual content, defined standards of competence, 
examinations, code of ethical behavior, members 
have a loyalty to the profession, and the protes- 
sion has the right to eject someone from member- 
ship and practice for incompetence or unethical 
behavior. 

The U.S. Taft-Hartley Act defines a profes- 
sional as an employee engaged in work requiring 
an advanced type of knowledge acquired at an in- 
stitution of higher learning, requiring the con- 
sistent exercise of discretion and judgment, which 
is primarily intellectual and varied in character, 
and the output of which cannot be standardized. 
(We have abbreviated, but this is the gist.) 

The main components are: defined body of 
knowledge of high intellectual content, defined 
standards of competence, examinations, code of 
ethics, and disciplinary capability. 

We contacted all of the computer field societies 
and organizations that we found reference to, in 
various countries, that were reported to be con- 
cerned with professionalism. The replies we re- 
ceived varied in the amount of detail provided. 
We will give an overview of the accomplishments 
that were reported to us. 


Definitions of competence 


The definition of competence to do a job ob- 
viously should begin with a definition of what the 
job involves. The effort involved in defining a job 
can vary from one person doing it in a few min- 
utes’ time (generally superficial, if the job has any 
complexity) to a study of a carefully constructed 
sample of workers, to find out what they actually 
do on their jobs. 

The American Federation of Information Proc- 
essing Societies, Inc. (aFrrps) has sponsored a study 
of the latter type to define the programmer's job, 
conducted by Dr. Raymond Berger. The results 
have been published in Reference 1. Actually, 


nine job categories were covered: junior pro- 
grammer, programmer, and senior programmer 
levels for business data processing programming, 
scientific programming, and system software pro- 
gramming. First, a panel of expert programmers 
was asked to identify the job functions that they 
felt make up some of the nine categories. Then a 
survey was conducted which resulted in 684 pro- 
grammers indicating the job functions they ac- 
tually perform. (It was interesting to note the 
differences between the experts’ opinions and the 
survey results.) A set of functions for each job was 
then specified. 

The next steps in the process are to define the 
knowledge required for each job function, to de- 
fine a level of competence (in terms of knowl- 
edge) in each function for each job category, and 
then to develop examinations to test for that level 
of competence. There is a difference, of course, 
between true competence to do a job and a meas- 
ure of the knowledge that a person has about that 
job. Even so, written examinations are a widely 
accepted means of determining competence. 

As we understand it, 1ccp will use the results of 
this arips study for developing such exam- 
inations. More about this later in this report. 

AFips has continued their support of this proj- 
ect. Dr. Berger is now making much the same 
type of study for defining the system analyst job. 
When it is completed, arips will publish the 
results. 

The Association for Computing Machinery 
(AcM) has developed curriculum recommenda- 
tions both for “computer science education” and 
for “computer education for management;” see 
Reference 2. In both cases, these were developed 
largely by professors, based on their concepts of a 
suitable body of knowledge. In neither case was 
the curriculum based on job definitions such as 
were developed as in the arips study. So bodies of 
knowledge and curriculums probably will have to 
be defined for the programmers and system ana- 
lyst jobs. (The acm curriculum committees prob- 
ably would say that they were aiming at a level of 
competence above those of “programmer” or 
“system analyst” and for which job definitions are 
not likely to be available for many years.) 

Other important work has occurred, such as the 
accreditation of private Epp schools. 

Denmark. In a 1972 report prepared for the Or- 
ganization for Economic Cooperation and Devel- 
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opment (oEcD), the Danish Epp Council defined 
job titles and job descriptions for data processing 
jobs, ranging from EDP manager to keypunch op- 
erator. Some 60 activities were identified within 
the data processing operation, and related to job 
titles, for both large and small organizations. Fin- 
land, in 1972, prepared a report on standard job 
titles. 

Sweden. In 1974, a study was completed by 
Servi-Data aB in which data processing job func- 
tions were decomposed into activities. The goal 
in this case was to develop a better structure for 
data processing educational programs. 

So some progress has been made toward stand- 
ard job definitions which in turn can be related to 
the knowledge needed and minimum levels of 
competence required. It is likely that several 
types of “programmer” jobs will be defined first, 
followed by several types of “analyst” jobs. 


Examinations for competence 


United States. The Certificate in Data Process- 
ing (CDP) program was developed by ppma in the 
early 1960s. We wrote up the program and the ex- 
amination in our July 1965 issue. After the forma- 
tion of Iccp, DPMA turned the cpp program over 
to1ccp. As far as we have been able to determine, 
the characteristics of the examination are still 
quite similar to what we discussed in 1965. 

The examination has five sections of 60 mul- 
tiple choice questions each. Iccr is considering 
additional sections and is working to improve the 
content of existing ones. 

The examination traditionally is given once a 
year, on the third Saturday in February. Since its 
inception, 31,531 candidates have sat for the cpp 
and 15,115 have been awarded the certificate. In 
the February 1975 exam, conducted under Iccp, 
2,096 sat for the exam and 675 were awarded 
certificates. 

The Registered Business Programmers exam- 
ination (RBP) was also developed by ppma. The 
number of candidates for the rBP fell off markedly 
after the exam was first given and it has since been 
suspended. Even so, ppMA turned over the rights 
to this exam to 1ccP and it is being restudied with 
a view to possible restructuring. Iccp is com- 
mitted to offering it again in the near future. 

Iccr has signed a long-term agreement with 
the Psychological Corporation, for conducting 
Iccp’s testing program, including the cpp, and 


for consultation, services, and administrative 
support. 

Canada. As mentioned earlier, the Canadian 
Information Processing Society is active in IccpP, 
indicating an interest in certification. 

Also as mentioned earlier, the Informatics In- 
stitute of Canada has been formed. Main areas of 
interest will be to ensure competent and ethical 
information processing services by way of profes- 
sional accreditation programs that use national 
education and career guidelines. 

Netherlands. A “non-regular” education pro- 
gram in informatics has been defined and is sup- 
ported by the Dutch government; in this instance, 
“non-regular” means that it is not being con- 
ducted by the regular institutions of higher edu- 
cation. The education program is modular, with 
some modules required and some optional, de- 
pending on a student's interests. Examinations are 
given at the end of each module. Successful com- 
pletion of modules can lead to programming cer- 
_ tificates (in either COBOL or FORTRAN/ALGOL) 
and/or to the amBi certificate (“Automation and 
mechanization of management information proc- 
essing’). The program is used by Dutch private 
and public organizations for recruiting and per- 
sonnel selection, promotion, and remuneration. 

South Africa. The Computer Society of South 
Africa is following a course somewhat similar to 
that of the British Computer Society. That is, full 
membership in the society is based upon passing 
Part 2 of the Bcs examination (or equivalent 
exam), or holding an Honors degree in com- 
puting, plus five years of experience in the field. 
In general, the society considers that competence 
is attested by means of formal education pro- 
grams, including examinations, that lead to de- 
grees, diplomas, or certificates of competence. 

Spain. A 5-year curriculum has been developed 
by the Spanish government and is offered at a 
number of schools and universities. A successful 
candidate receives an appropriate degree at the 
end of each year, attesting competence. At the 
end of the first year, the degree is for applications 
programmer; second year, systems programmer; 
third year, applications analyst; fourth year, sys- 
tems analyst; and fifth year, systems engineer. 

United Kingdom. The Bcs examination, men- 
tioned earlier, is perhaps the foremost exam- 
ination of its kind. The examination is given in 
two parts. The first part is designed for student 
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members and consists of two compulsory papers 
covering general computing knowledge, of 3 or 4 
hours’ duration, and two specialist papers (from a 
list of eight subjects), each of three hours’ dura- 
tion. Exemption from Part 1 may be sought on the 
basis of bachelor level degrees in business studies, 
computer studies, or mathematics. In order to 
take Part 2 of the examination, the candidate 
must have passed Part 1 or have obtained an 
exemption from it. Part 2 may be satisfied either 
by submitting a dissertation on an agreed-upon 
subject and subsequently discussing this with a 
panel of examiners, or by submitting three papers 
on two subjects, selected from a list of subjects. 
Two papers will be on one of the subjects, with 
the second paper being at a higher standard than 
the first, and the third being a first paper on an- 
other subject. Subjects include system program- 
ming, data processing and information systems, 
advanced programming theory, and others. 

The scs examination does not claim to be a 
guarantee of professional competence but rather 
a certification of a recognized level of profes- 
sional education. It is used to obtain full member- 
ship status in the Bcs. We have not heard that it is 
being widely used by employers for hiring, pro- 
motions, and raises, but we suspect that employ- 
ers do give it considerable weight in such matters. 

The National Computing Centre, in Manches- 
ter, has developed examinations and certificates 
for system analyst training. We discussed the Ncc 
basic system analyst training and examination in 
our August 1970 issue. The training program typ- 
ically consisted of six weeks of training, at six 
hours per day. 

We have seen no studies on the matter but we 
gather from comments made to us that the Ncc 
certificates have been used by U.K. employers for 
hiring, promotions, and raises. In this instance, 
the training and the examinations address a very 
specific population—namely, business system 
analysts. 

Once again, progress has been made during the 
past eight to ten years on examinations for com- 
petence in data processing. It is our belief that 
none of these were based on standard job defini- 
tions developed from studies such as the AFIPs 
study. However, some of the examinations would 
seem to be measuring knowledge levels required 
on specific jobs, such as business system analysts. 

Should readers desire more information on 


these examinations, we have developed a free bib- 
liography (Reference 9) that gives the addresses of 
where to write for more information. 


Code of ethical behavior 


United States. Each professional society in the 
computer field seems to have developed its own 
code of ethics. In general, however, no enforce- 
ment mechanisms have been provided and en- 
forcement of the codes is very much the 
exception. 

Iccr has developed its code of ethics; the en- 
forcement mechanism for it remains to be seen. If 
and when iccp certificates become widely used 
by employers for hiring, promotions, and raises, 
then the opportunity for an effective enforcement 
mechanism will exist. Certificate holders could be 
disciplined by suspending or revoking their cer- 
tificates, which could have a financial impact on 
them. Of course, the costs of enforcement, in- 
cluding legal costs, would be non-trivial. 

It would be helpful, of course, if a common, 
field-wide code of ethics were adopted. This 
might come about for societies that are members 
of aFips, and some efforts have been made along 
this line. But so far it has not occurred. 

South Africa. The Computer Society of South 
Africa has developed a code of professional con- 
duct, applying to its members. 

Spain. A foundation in Madrid (cirEma) has de- 
veloped a code of professional ethics with ten 
principles, or rules. It addresses, among other 
things, the handling of personal data. 

Sweden. While no explicit code of ethics has 
been established, the Swedish Privacy Act pro- 
vides an implicit code, certainly as to the han- 
dling of personal data. 

United Kingdom. The scs has a Code of Con- 
duct, together with an enforcement mechanism 
incorporated in its Articles of Association. The 
enforcement mechanism consists of an in- 
vestigative committee, a disciplinary committee, 
and an appeals committee. Since attaining full 
membership in the bcs is a difficult matter (for in- 
stance, passing the Bcs exam), the loss or suspen- 
sion of membership might be a very effective 
disciplinary action. 

So in this area of codes of ethics, some progress 
has been made toward establishing such codes 
and a small amount of progress has been made to- 
ward effective enforcement. 
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Other developments 


Developments in the areas of system certifica- 
tion and the unionization of programmers and 
analysts should be mentioned. These are not “pro- 
fessional” activities, in the accepted sense of the 
term. But both do represent forms of regulation or 
constraint on employers. 


System certification 


Earlier in this report, we mentioned the aFips 
project on system certification. (We have been in- 
volved in this project from its inception and so 
cannot claim a lack of bias about it.) The only 
progress toward application system certification 
that we have come across is this aAFIPs project. 

The aFips project began in 1970 and 1971, with 
two small workshops to consider the question: can 
computer-based systems be certified? Each work- 
shop was attended by a small group of people se- 
lected for their knowledge in this area, plus one or 
two people representing arips. The first work- 
shop concluded that system certification was not 
possible at that time but that manuals of preferred 
(or standard) practices were feasible and needed. 
The second workshop continued the analysis and 
concluded that, instead of manuals of preferred 
practice, system review manuals were needed 
first. 

To illustrate why the workshops felt that sys- 
tem certification is beyond the state of the art 
now, consider the feasibility of someone signing 
the following statement: “I certify that this appli- 
cation system performs its defined job, the whole 
job, and nothing but the job, and cannot surrepti- 
tiously be made to do otherwise.” The state of the 
art is such that users do not (cannot?) precisely de- 
fine the job that an application system is to do; in 
most cases, the “definition” evolves as the system 
is developed and maintained. Also, there is no 
way of assuring that a system cannot be changed 


undetected a short time after a certification study 


has been performed. 

If that certification statement seems too strong, 
consider the following: “T certify that this appli- 
cation system was designed and is operated in ac- 
cordance with generally accepted practices of the 
computer field.” At present, such a statement is 
essentially meaningless; the practices have not 
been codified. 

If system certification is impractical at this 
time, should not the next most logical step be to 


codify the “generally accepted” practices? Man- 
uals of preferred or standard practices are needed. 
However, they are not easily created. The ac- 
counting profession, for instance, now goes 
through extended discussion, debate, revisions, 
etc., when developing just one “generally ac- 
cepted” accounting principle. To come up with 
good quality manuals of preferred practices for 
the computer field will take substantial time and 
effort. 

This is why the arips System Certification 
Committee chose to develop a set of “system re- 
view manuals,” instead of preferred practice 
manuals. The first such manual is on security (Ref- 
erence 3). The manual is really a huge checklist of 
questions—over 100 pages of them. This checklist 
can be used by system designers, by managers, 
and by auditors. Each question asks: Have you 
thought about, and provided for, this aspect of 
security? Not all questions pertain to any one in- 
stallation at any one point in time. But the check- 
list makes one think. As one reviewer of the 
manual stated, it tends to give one a feeling of in- 
security, there being so many things to consider 
under the heading of security. 

As experience is gained in the use of the check- 
list, it should be possible to revise and improve it. 
The checklist could then become the basis of a 
good quality manual on preferred (or “generally 
accepted’) security practices. Then, at that time, 
it might be feasible to certify that application sys- 
tems follow the generally accepted practices. 

This same procedure would have to be fol- 
lowed for other aspects of system design, con- 
struction, and operation of computer-based 
systems. 

The certification of operating systems is prob- 
ably more complicated than for application sys- 
tems. If an operating system is to be certified as to 
security, then a certification more like the first il- 
lustration given above is required. The certifica- 
tion should be of the type: “this operating system 
is secure and it cannot surreptitiously be made in- 
secure. The state of the art just will not support 
such certification. A representative of a project 
that has been studying operating system security, 
at a recent meeting, made the statement to the ef- 
fect that his organization does not know how to 
certify as secure any operating system; moreover, 
they are not able to predict when they will be 
able to do so. Thus the status on operating system 


EDP ANALYZER, MARCH 1976 


security is essentially the same as we reported in 
our May 1970 and January 1974 issues. 

As we discussed in the November and Decem- 
ber 1975 issues, the new privacy legislation may 
force some form of system certification, before 
personal data can be transferred from one system 
to another. It is not yet apparent just how valid 
such system certification really will be. However, 
in the December issue, we reported that Dr. Dor- 
othy Denning of Purdue University has devel- 
oped a computerized method for certifying 
certain aspects of computer programs. In this 
method, a certifying program tests a candidate 
program as far as access to and dissemination of 
personal data are. concerned, and reports any de- 
tected violations of privacy regulations. This 
would seem to be an important step toward the 
eventual general certification of programs. 


Unionization of programmers 


At a meeting in San Diego a little over one year 
ago, the subject was the possible unionization of 
data processing personnel, particularly system 
analysts and programmers. Computer operators 
are already unionized at a number of organiza- 
tions, but to date relatively few analysts and pro- 
grammers have joined unions. The purpose of the 
meeting was to discuss the pros and cons of their 
doing so. 

The subject was approached indirectly, via 
representatives of three other types of unions: 
aeronautical engineers, office employees, and uni- 
versity professors. Each representative discussed 
what the benefits of union membership are. The 
main points that were advanced were: 

Avoid exploitation. Many groups are being ex- 
ploited by employers, it was stated. By band- 
ing together in a union, with a common cause, 
the employees gain strength to combat the 
exploitation. 

Provide job security. This aspect is particularly 
important to employees during recessionary 
times, by making it more difficult for employers 
to lay off union members. 

Improve job benefits. Such benefits can include 
pension plans, paid health insurance, guaranteed 
working conditions and hours, vacations, over- 
time and shift differential pay. 

Provide more control over one’s working life. 
For instance, the professor said he wanted to be 
able to give his students grades of all As or all Fs, 


if he desired, as an example of the working life 
freedom that he sought. 

In the discussion following the presentations, 
the union representatives said that they felt pro- 
fessional societies could not fill the same needs as 
could unions. Professional societies are useful for 
the exchange of technical information, but unions 
are more effective for job protection and in- 
fluence on employers. 

Eppacs (Reference 4) has discussed briefly the 
unionization of data processing personnel, mostly 
from the standpoint of the disadvantages to the 
employer. A strike by a relatively small number 
of people (in data processing) might possibly shut 
down the whole organization. This is particularly 
true if computer operators strike and supervisors 
are unable to take over and run the equipment. 
Moreover, with unions involved, it is harder to 
keep supervisory people capable of running the 
equipment so as to be able to step in, in case of a 
strike. And with unions, it is harder to enforce 
good discipline because it is harder to take dis- 
ciplinary action against union members. 

The unionization of analysts and programmers 
as yet is not widespread. It can occur in parallel 
with developments in professionalism. And it can 
come a lot faster than professionalism, as far as 
any particular organization is concerned, when 
the conditions are “right.” 


What seems likely to happen? 

As the above discussion implies, we do not be- 
lieve that any of these developments—profes- 
sionalism, system certification, unionization—will 
have a major impact on the computer field in the 
next five years or so. On the other hand, there are 


active pressures for all of them. Any one of them | 


could be important to data processing manage- 
ment. And as far as any particular organization is 
concerned, any or all of them could occur within 
the next five to ten years. 

What is likely to happen? Following are our 
opinions on this matter. Recognize that, as with 
anything that has strong pro and con arguments 
associated with it, there is a lot of conjecture in 
forecasting what will happen in these three areas. 
Moreover, we are confining our remarks to what 
seems most likely to happen in the United States, 
rather than in other countries. 


An overview of “professionalism” 
Just who are the prospective professionals? All 
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analysts and programmers? Or only “‘senior 
analysts’ and “senior programmers’? What 
about computer operators; will they qualify as 
professionals? 

To get a better perspective on such questions, 
we reproduce a table from the report on a work- 
shop sponsored by the U.S. National Bureau of 
Standards and the Association for Computing 
Machinery, Reference 5. This table gives a broad 
summary of the makeup of the system devel- 
opment staff of one large business organization. 
In addition to job categories, it gives the approx- 
imate percent of total development staff in each 
category, as of about three years ago. 


STAFF OF ONE ORGANIZATION 


Category Job % of staff 
A Large system architects ] 
B Large system project managers 1 
C Computer scientists (Ph.D.s) i 
D ____ Business system analysts with 
little knowledge of programming 10 


ie 


Professional programmers, experi- 
enced, interested in keeping up 
with the technology, have 
initiative to do self-training, 
capable of recognizing that others 
have already solved a particular 
problem. 22 
F Craftsmen programmers, less 
experienced, have less initiative, 
are less likely to recognize that 
a problem has been solved by 
others; willing to use guidelines, 
etc., if directed. 44 
G ___ Dull programmers, with little or 
no interest or initiative; just 


doing a job. 22 


Moreover, said the participatnt offering this in- 
formation, the “center of gravity’ seems to be 
shifting from the F category down toward the c 
category. The c category might well become the 
largest in terms of percent of staff. 

Using this one organization as perhaps a first 
approximation of the total population of analysts, 
programmers, etc., what can one say about “‘pro- 
fessionalism”? From a technical standpoint, the 
large system architects (A) and the computer sci- 
entists (c) might well be in one category of profes- 
sionals. Large system project managers may or 
may not qualify technically as professionals, de- 
pending on their technical backgrounds. 

If “business system analysts with little knowl- 
edge of programming” are to be classified as pro- 


fessionals, it seems clear that the requirements 
cannot demand a deep knowledge of the com- 
puter. Are these people to be certified mainly on 
their ability to study existing systems and to de- 
velop sets of requirements for new systems? Or 
must they have a demonstrated ability to design 
new computer-based systems? If this will not be a 
“professional” category, will it be feasible for 
them to have higher salary levels than profes- 
sional programmers and (often) to be directing 
the work of professional programmers? 

Most advocates of professionalism, we suspect, 
would agree that category E is the programming 
group most entitled to professional certification. 
They have both a good level of job knowledge and 
a motivation to improve that level of knowledge. 

The question is, though: will some people in 
categories F and c force themselves to become 
certified as professionals and then drop back into 
their unmotivated ways? If the certification ex- 
aminations are difficult enough to eliminate just 
about all of the F and c categories, then (accord- 
ing to this model) only about one-fourth of all 
programmers are likely to be certified as profes- 
sionals. These people may already be recognized 
by their employers as talented, so these people 
may be reluctant to take the examinations 
where (they might believe) they stand a chance of 
failing. Hence the number of candidates for the 
programmer certificate might be quite small. 

There are several other factors involved in 
trying to identify who the professionals might be. 
For one thing, the concepts of team programming 
are catching on in popularity; we discussed team 
programming in our April 1974 issue. In team 
programming, each team member may specialize 
in only those aspects of programming in which he 
or she is particularly proficient. In such an 
environment, would a team member qualify as a 
professional? 

Another factor, which we discussed in our Au- 
gust 1972 report, is career paths for data process- 
ing staff members. At what point in one’s career 
would one be eligible to be a professional? For the 
medical profession, eligibility comes after gradu- 
ation from medical school and one year’s intern- 
ship at a hospital. Would the apprenticeship be 
longer for a data processing professional? If so, on 
what justification? 

Still another factor is the breadth of knowledge 
that will be demanded of a professional. Finer- 
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man, in Reference 6, discusses an interesting point 
that some people at the Massachusetts Institute of 
Technology have developed. In the opinion of 
these people, the educational program for com- 
puting should provide not only the needed profes- 
sional skills but also the breadth of understanding 
needed to become responsible professionals. This 
includes an awareness of social and cultural prob- 
lems that arise from the fragmentation of knowl- 
edge, the social consequences of science and 
technology, and the need for more contemplation 
on the part of the professionals. The computer 
science curriculum, Curriculum 68, developed by 
an ACM committee, falls short of this objective be- 
cause it concentrates only on the professional 
skills, say these people. Finerman says that engi- 
neers and scientists are being held increasingly 
accountable for the effects of their work on so- 
ciety—and the same will be true of computer field 
professionals. 

We could go on but perhaps this discussion 
makes the point. As we see it, the true profes- 
sional status for system analysts and/or program- 
mers—similar to that of doctors and lawyers— 
seems no closer today than it was ten years ago. It 
is not clear just what body of practitioners should 
rightly classify as professionals. When in their ca- 
reers should they become eligible to be profes- 
sionals? What body of knowledge should they be 
expected to know—and should it include the so- 
cial aspects of computing as well as the technical? 
There are no clear answers to these questions as 
yet. We do not see true professionalism coming to 
the computer field until there are much better 
answers. 

At the same time, some aspects of profes- 
sionalism do seem close. These include the certifi- 
cation of analysts and/or programmers and 
possibly the adoption and enforcement of a field- 
wide code of ethics. 


Certification 


With the formation of the Institute for Certifi- 
cation of Computer Professionals in 1973, a major 
step was made toward certification of analysts 
and programmmers in North America. Iccp is 
made up of eight charter member societies: Asso- 
ciation for Computing Machinery (acm), Associ- 
ation of Computer Programmers and Analysts 
(acpA), Association for Educational Data Systems 
(AEDs), Automation One Association (Ala), Cana- 


dian Information Processing Society (cies), Data 
Processing Management Association (DPMA), IEEE 
Computer Society (IEEE cs), and the Society of 
Certified Data Processors (ScpP). 

We have already mentioned that ppma has re- 
leased to ccp the cpp and rBp examinations. The 
RBP examination has been suspended, pending 
further study, and 1ccp at the moment is offering 
only the cpp. 

But the 1974 1ccp Annual Report makes some 
interesting points about how the Institute sees the 
future. Here are the main points. 

Certification. The first priority for 1ccr re- 
sources goes to the certification activities. At the 
top of the list is a project to review and improve 
the cpp, as well as to identify its proper role in an 
overall certification program. Almost equally im- 
portant, however, is the development of a struc- 
ture for future certification exams. Iccp believes 
that this structure will be modular, with some 
modules required and others optional. It is pos- 
sible that some modules will be quite specific, 
such as the design of data communications net- 
works. Further, the structure may well tie the ex- 
aminations to the standard job definitions 
developed under the arips study; this point was 
not made in the report but has been mentioned 
verbally. 

The decisions on the structure of the certifica- 
tion program also must consider the question of 
re-certification or dated certification. The point 
here is that rapid technical changes are being 
made in the computer field. Many of the benefits 
of certification will be lost if certificate holders 
become technically obsolete but are allowed to 
retain their certificates. 

Finally, as a part of the structure, entry level 
examinations must be defined. It is possible that 
the present cpp is such an exam. The knowledge 
requirements for the cpp are fairly broad and 
fairly shallow, as we discussed in our July 1965 re- 
port. For instance, the math questions mainly are 
at the level of first year algebra. Candidates often 
have little difficulty in answering the questions 
that pertain to their specialties; the difficulties 
come with the other sections of the exam. We 
have observed, for example, that programmers of- 
ten answer the computer-related questions easily 
but have all sorts of difficulties with the account- 
ing questions. In any case, one or more entry level 
examinations must be identified—and it may turn 
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out that the cpp is one such exam. 

Self-assessment. In addition to certification ex- 
aminations, IccP is quite interested in the idea of 
self-assessment examinations. These are self- 
administered exams that a person can take and 
grade at home. The purpose is to tell the person, 
not someone else, how his or her knowledge of a 
subject compares with peers. To be most useful, 
such exams should be related to jab definitions 
and to defined curricula. The person thus finds out 
if his or her knowledge is not sufficient to perform 
a type of job and, if this is the case, where to get 
the needed knowledge. 

Self-assessment might also be tied into a re- 
certification program. It could point out to a cer- 
tificate holder, well before a re-certification date 
is at hand, just what the state of his knowledge is. 

Other activities. There are other areas in which 
iccp is interested, but in which the Institute prob- 
ably will not do much until more resources are 
available. These include the development of 
codes of conduct and good practice, educational 
standards and guidelines, accreditation guide- 
lines, salary surveys, and perhaps even the licens- 
ing of people for certain data processing jobs. 

Iccp conducted a planning workshop in De- 
cember 1975 to consider the future structure of 
certification examinations. A long-range (ten 
year) structure is being developed, covering both 
certification and self-assessment exams. The cpp 
and RBP programs will then be evaluated with re- 
spect to this suggested structure, after which 
changes may be recommended. 

For more information on IccP and its activities, 
see Reference 7. 


Licensing 

We have hardly mentioned the idea of licensing 
data processing people in this report. This is not 
because the idea has not received much attention 
but rather because it appears that the issue has 
been settled for the present. 

What is the difference between certification 
and licensing? Certification is the granting of a 
privilege, generally be a peer group. Thus, a pro- 
fessional society, or a group of societies in a field, 
can develop the certificate and the rules under 
which it is granted. A person generally can prac- 
tice in the field without a certificate—but of 
course cannot hold himself to be a certificate 
holder unless he actually is one. 


Licensing, on the other hand, is controlled by 
government agencies. It is the removal of a re- 
striction. The law says that no one may practice a 
specified job or occupation unless he or she has a 
license, which is granted by a specified govern- 
ment agency. So licensing implies a much greater 
degree of control over the practicing of an occu- 
pation than does certification. 

The Society of Certified Data Processors (scpP) 
decided to advocate the licensing of data process- 
ing personnel. In 1974, scpp developed a model 
bill and submitted it to a number of state legisla- 
tures. Under this model bill, no person in a state 
which passes the bill could “practice, continue to 
practice, offer or attempt to practice data proc- 
essing or any branch or part thereof, unless specif- 
ically exempted by this Act.” A grace period of 24 
months would be allowed in which practitioners 
could obtain the necessary academic quali- 
fications, etc., required under the Act. 

Why did scpp a advocate this action? In the 
words of K. W. Lord, scpp’s president, “It came 
into being because we at scpp felt that the pro- 
liferation of privacy legislation being considered 
around the nation omitted the most critical part 
of the privacy question—the people involved. Pri- 
vacy efforts, however, are but a small part of the 
question. Accountability, responsibility, ethics, 
and leverages are all a part of the effort. We rea- 
son that one does not truly have a profession until 
one has the ability, legally, to challenge a prac- 
titioner and when proven guilty, to see that he is 
separated from the practice . . . There are several 
sets of codes of ethics in existence, all reasonably 
well thought out ... and all missing one key ele- 
ment—teeth. Or more specifically, leverage. 
Proved violation can lead to the removal of a cer- 
tificate or the slapping of hands, but beyond that, 
nothing. This is one problem the scpp licensing 
bill will solve.” For more information on the scpp 
views, see Reference 8. 

Readers of the trade press in the U.S. will know 
what a furor this proposal stirred up. Letters to 
the Editor of Computerworld, for instance, argued 
the pros and cons for many weeks. The bulk of the 
letters argued against the proposal, as we remem- 
ber, by a factor of 4 or 5 to 1. 

But legislators have not been unwilling to enter 
the model bill and submit it to the legislative 
process. The public has been annoyed, and at 
times hurt, by poorly designed computer-based 
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systems. The troubles are generally not irrevers- 
ible. They might well be due to the newness of the 
technology. No strong case has yet been made, 
that we know of, that the troubles are generally 
due to incompetency. 

But even if such a model bill were introduced 
into any given state legislature, this does not in- 
dicate that it would be favorably considered by 
the committee to which it was assigned. We have 
a copy of two letters from a committee chairman 
of the California Assembly, regarding the refusal 
of his committee to look favorably on a proposed 
“Industrial Engineers Practice Act.’ He said that 
he had been active on licensing committees for 13 
years—and had received licensing bills from as- 
trologers, massage therapists, hypnotists, corro- 
sion engineers, forestry practice engineers, 
chemical engineers, etc. All who seek licensing 
describe their license as a public benefit, he says. 
But, in general, no case is made that the public 
will benefit. No case is made proving in- 
competency among those practicing. And no case 
is made that the products or services offered by 
manufacturers or others would be improved by 
the licensing act. So here is one legislator, at least, 
who subjects licensing bills to a very critical 
analysis. © 

Scpp, by advocating licensing of data process- 
ing personnel and by submitting their model bill 
to a number of state legislatures, has sought a 
crystallization of thought on the matter. We be- 
lieve that the crystallization has occurred—and 
mainly in opposition to the idea, at least for the 
present. It seems very unlikely to us that licensing 
of data processing personnel will occur in the U.S. 
within the next five years. Some special cases 
might arise, perhaps as a byproduct of other legis- 
lation, which will lead to the licensing of people 
for specific data processing jobs. But, as yet, there 
is no evidence that this will occur. 


Other aspects 


Code of ethics. Some efforts have been made to- 
ward getting all artes member societies to adopt 
a uniform code of ethics. Since many of the so- 
cieties already have adopted their own codes of 
ethics, it has been difficult to muster arguments as 
to why they should replace their current codes 
with the new one. 

One step toward this, of course, would be if 
both arips and 1ccp adopted the same code of 
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ethics. We can visualize this happening within 
five years. 

Enforcement of a code of ethics. Enforcement 
requires one or more types of disciplinary action, 
and the disciplinary action must be “painful” 
enough that offenders will try to avoid it. Cur- 
rently, most computer field societies in the U.S. 
have nothing stronger than suspension or termi- 
nation of membership. The associated economic 
penalties are probably trivial. 

The suspension or revoking of a certificate, 
which has value as far as raises and promotions 
are concerned, would be a different matter. (Sus- 
pending or revoking a license would be even 
more severe.) This is why we believe that when 
1ccp develops job-related certificates, it will be in 
a position to begin enforcing its code of ethics. 

System certification. As we said earlier, true 
system certification seems to be beyond today’s 
state of the art. Until researchers can see how to 
do it, there is no use trying to predict when it will 
arrive. 

But, as we have mentioned, privacy legislation 
probably will force the need for “certification of 
security and privacy features” at installations and 
in application systems. We suspect that the first 
such certifications, when they occur, will be 
worded along the lines of “generally accepted 
security principles, plus the specific privacy prin- 
ciples specified in the Act, have been 
followed.” An ad hoc codification of these prin- 
ciples may be referenced. Such certifications will 
probably be very specific and quite limited as to 
what is certified. 

Unionization of analysts and programmers. We 
cannot say that such unionization will not happen 
on a wide scale in the next five years, but it does 
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seem unlikely. It may occur in some locations, 
such as at a distressed organization where the ana- 
lysts and programmers want job protection. 
Moreover, it could occur rapidly, and in a wide- 
spread fashion, if a recession severely affected the 
computer field. | 

In brief, then, here is our opinion of what will 
happen and not happen in the next five years or 
so, as far as professionalism is concerned: 

Not happening. We do not see true profes- 
sionalism for system analysts and programmers 
coming about in anything like the next five years. 
We do not see true system certification as being 
achieved in that time. Nor do we see widespread 
unionization of analysts and programmers. 

Happening. We do foresee substantial progress 
in defining the jobs of analysts and programmers 
and in defining minimum knowledge levels for 
those jobs. We foresee job-related examinations 
being developed, for at least some of the levels of 
some of the jobs; successful passing of the exams 
would be evidenced by certificates being issued. 
It is possible that curricula will be developed (and 
perhaps even accepted by the educational com- 
munity), related to these job definitions and min- 
imum knowledge levels. If such certificates are 
created, then we can see the emergence of an en- 
forcement mechanism for a code of ethical behav- 
ior. And finally, we do think that some limited 
form of system certification will occur, in support 
of privacy legislation. 

In one sense, five years is not a very long time 
and maybe not all of these things can occur in that 
period of time. But there has already been sub- 
stantial progress toward them, so we believe that 
the chances of their coming to fruition are reason- 
ably good. 
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Some rather simple words in existing and proposed privacy legislation— 
words such as “accuracy,” “integrity” and “security”—will pose a prob- 
lem to many data processing executives. The challenge already exists for 
U.S. federal agencies. It will probably confront the remaining public and 
private sectors in the U.S. as well as in some other countries in the next 
few years. The problem is, these words cannot be put into practice as eas- 
ily as might first be imagined. But if they are not put into practice, the 
threat of both civil and criminal penalties arises. Next month, we will dis- 
cuss what the privacy legislation says on these points and what the con- 
sequent implementation problems appear to be. 
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